The present invention relates generally to the field of intrusion prevention, and more particularly to prioritizing intrusion events.
Intrusion prevention systems (IPS) are network security appliances that monitor network and/or system activities for malicious activity. The main functions of intrusion prevention systems are to identify malicious activity, log information about this malicious activity, attempt to block/stop the malicious activity, and report the malicious activity. Intrusion prevention systems are considered extensions of intrusion detection systems because they both monitor network traffic and/or system activities for malicious activity. The main differences are, unlike intrusion detection systems, intrusion prevention systems are placed in-line and are able to prevent/block intrusions, in real time, that are detected. More specifically, the IPS can take such actions as sending an alarm, dropping the malicious packets, resetting the connection and/or blocking the traffic from the offending IP (Internet protocol) address. An IPS can also correct Cyclic Redundancy Check (CRC) errors, unfragment packet streams, prevent transmission control protocol (TCP) sequencing issues, and clean up unwanted transport and network layer options.